NetBIOS Design Allows Traffic Redirection

iago-vL writes "Security researchers at SkullSecurity have demonstrated how the NetBIOS protocol allows trivial hijacking due to its design, through the use of a tool called 'nbpoison' (in the package 'nbtool'). If a DNS lookup fails on Windows, the operating system will broadcast a NetBIOS lookup request that anybody can respond to. One vector of attack is against business workstations on an untrusted network, like a hotel; all DNS requests for internal resources can be redirected (Exchange, proxy, WPAD, etc). Other attack vectors are discussed in a related blog post. Although similar attacks exist against DHCP, ARP and many other LAN-based protocols, we all know that untrusted systems on a LAN means game over. NetBIOS poisoning is much quieter and less likely to break other things."

Re:Samba 3 Domain Controllers and Mutant NT Domain

[lukas84]

Samba is still stuck in NT4 times. That's why everyone should get rid of it. The hacks needed to make it work with Windows 7 alone show the age of the software.

I'm aware that the development to get Samba up to the level of WS08R2 is in the work, but it's nowhere near where Microsoft is right now.

Re:Samba 3 Domain Controllers and Mutant NT Domain

[lukas84]

Yep. The difference is that you blame Windows and i blame Samba.

Comment removed

[account_deleted]

Comment removed based on user account deletion

DEAR GOD

[Anonymous Coward]

WHAT IS WRONG WITH YOU?

In other news...

[CPE1704TKS]

the security for the horse and buggy was compromised by experts who simply offered the horse a carrot. This allowed full access and control to the vehicle. Experts are at a loss to fix this security hole, and are actively encouraging users to upgrade to a newer technology.

Re:Samba 3 Domain Controllers and Mutant NT Domain

[Bert64]

The problem is that MS implement something, and samba has to play catch up... If samba would implement something first, MS would simply ignore it and do their own thing instead.
Also if MS implements something, they keep it as secret and obfuscated as possible - making it difficult for someone else to reverse engineer and implement, groups like samba openly document what they do making it easy for third parties to create their own implementations.

What we really need are standards which are decided independently, with equal access for everyone.